Routine submissions are not the full reports. For assessments carried out during 2026 and 2027 the submission is due by 1 April 2028, and for later years by 1 April of the following year: its name and contact, the period covered, the number of assessments done or updated in total and per trigger, which categories of personal and sensitive information they involved, and an attestation under penalty of perjury by a responsible executive with sufficient knowledge and authority, filed via the CPPA website. Full risk assessment reports go to the CPPA or the Attorney General only when either demands them, within 30 calendar days of the request.
CCPA/CPRA CCR 7157 is one control. If you already hold one of the frameworks below, a reviewed crosswalk already says how much of CCPA/CPRA your existing evidence covers. Hold GDPR and 17 of 89 CCPA/CPRA controls already carry evidence.
Each report names every control your existing framework evidences, every one it does not, the reasoning behind each claim, and the claims that were argued against and rejected. 0 were rejected on the GDPR pair alone.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.